diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fa0cf61..9dbe127 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,22 +2,34 @@ name: CI
 
 on:
   push:
+    branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
-  test:
+  check:
+    name: Typecheck, test, and pack dry-run
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - name: Checkout
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
         with:
           node-version: 24
           package-manager-cache: false
-      - run: npm ci
-      - run: npm run check
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run check
+        run: npm run check
 
       - name: Verify version bump policy
         if: github.event_name == 'pull_request'
diff --git a/package.json b/package.json
index 3a9c173..dbc7dab 100644
--- a/package.json
+++ b/package.json
@@ -31,7 +31,7 @@
   "scripts": {
     "typecheck": "tsc --noEmit",
     "test": "node --import tsx --test \"test/**/*.test.ts\"",
-    "check": "npm run typecheck && npm test",
+    "check": "npm run typecheck && npm test && npm run release:npm:dry",
     "release:npm:dry": "npm pack --dry-run",
     "prepublishOnly": "npm run check",
     "version:check": "node scripts/check-version-bump.mjs"